3.4 Identify and Describe Tunneling Protocols (e.g., SSH, TLS, IKE) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A network engineer is troubleshooting a site-to-site IPsec VPN that is not passing traffic. The VPN gateways are configured with the same pre-shared key, but the tunnel does not come up. The engineer checks the logs and sees that IKE Phase 1 is failing. Which of the following is the most likely cause of the Phase 1 failure?

   • AThe SSH service is not running on the VPN gateway.
   • BThe web server is not responding on port 443.
   • CThe IPsec security associations (SAs) have expired.
   • DMismatched encryption or authentication algorithms between the two gateways.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a new web application that must be accessible to customers over the internet. The security team has a requirement that all traffic must be encrypted, but they also need to inspect the plaintext traffic for malicious content using an intrusion prevention system (IPS). The IPS is placed inline between the load balancer and the web servers. Which deployment approach allows the IPS to inspect the traffic while still meeting the encryption requirement?

   • AUse IPsec between the load balancer and the web servers, and configure the IPS to decrypt the IPsec traffic.
   • BTerminate TLS at the load balancer, send plaintext traffic to the IPS, and then re-encrypt with TLS before sending to the web servers.
   • CDo not use encryption between the load balancer and the web servers, since the data center is already a trusted environment.
   • DUse SSH tunneling between the load balancer and the web servers, and configure the IPS to decrypt the SSH traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer is configuring a site-to-site VPN between two offices. The VPN will use IPsec to encrypt all traffic. During the configuration, the engineer must specify the encryption and authentication algorithms, the Diffie-Hellman group, and the pre-shared key. In which phase of the VPN setup are these parameters negotiated?

   • AIKE Phase 2
   • BTLS handshake
   • CIKE Phase 1
   • DSSH handshake
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of IKE in an IPsec VPN?

   • ATo compress data to reduce bandwidth usage.
   • BTo authenticate users accessing the VPN.
   • CTo negotiate security associations and exchange keys for the IPsec tunnel.
   • DTo encrypt the data packets transmitted over the VPN.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A branch office connects to the corporate headquarters over the internet. The security team wants to encrypt all traffic between the two sites using IPsec. During the initial setup, the two VPN gateways need to agree on encryption algorithms, authentication methods, and keys before any data can be sent. Which protocol is responsible for establishing this agreement and creating the security associations?

   • AIP Security (IPsec) itself
   • BSecure Shell (SSH)
   • CInternet Key Exchange (IKE)
   • DTransport Layer Security (TLS)
   Reveal Solution Discussion Select an answer first